Merge branch 'main' into update-mstest

.github/workflows/codeql-analysis.yml

@@ -30,10 +30,10 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      uses: github/codeql-action/init@dd196fa9ce80b6bacc74ca1c32bd5b0ba22efca7 # v3.28.3
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      uses: github/codeql-action/autobuild@dd196fa9ce80b6bacc74ca1c32bd5b0ba22efca7 # v3.28.3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      uses: github/codeql-action/analyze@dd196fa9ce80b6bacc74ca1c32bd5b0ba22efca7 # v3.28.3

.github/workflows/gen-docs.yml

@@ -38,7 +38,7 @@ jobs:
           EOF
 
       - name: Commit
-        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
+        uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0
         with:
           commit_message: 'Auto update docs/*.md'
           file_pattern: 'docs/*.md'

.github/workflows/pr-comment-api-change.md

@@ -0,0 +1,16 @@
+This PR changes files in the API project. Does it change _any_ of the API interfaces in _any way_? Please note that this includes the following types of changes:
+- Changing the signature of an existing interface method
+- Adding a new method to an existing interface
+- Adding a required data member to a class that an existing interface method consumes
+
+Because any of these changes can potentially break a downstream consumer with customized interface implementations, these changes need to be treated as breaking changes. Please do one of the following:
+
+## Option 1 - Publish this as a breaking change
+1. Update the documentation to show the new functionality
+2. Bump the major version in the next release
+3. Be sure to highlight the breaking changes in the release notes
+
+## Option 2 - Refactor the changes to be non-breaking
+1. Review [this commit](https://github.com/microsoft/sbom-tool/commit/4d0ce83e194ed6feace53666aeb6280f5b8b8769), which adds a new interface in a backward-compatible way
+2. Refactor the change to follow this pattern so that existing interfaces are left completely intact
+3. Bump the minor version in the next release

.github/workflows/pr-comment-api-change.yml

@@ -0,0 +1,22 @@
+name: Check for API changes
+
+on:
+  pull_request:
+    paths:
+      - 'src/Microsoft.Sbom.Api/**/*.cs'
+
+jobs:
+  auto-comment:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+      - name: PR Comment
+        run:
+          gh pr comment $PRNUM --body-file .github/workflows/pr-comment-api-change.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PRNUM: ${{ github.event.pull_request.number }}

.github/workflows/release-drafter.yml

@@ -14,7 +14,7 @@ jobs:
   update_release_draft:
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # v6.0.0
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
         with:
           disable-autolabeler: true
         env:

Directory.Packages.props

@@ -38,7 +38,7 @@
     <PackageVersion Include="NuGet.ProjectModel" Version="6.11.1" />
     <PackageVersion Include="packageurl-dotnet" Version="1.1.0" />
     <PackageVersion Include="PowerArgs" Version="3.6.0" />
-    <PackageVersion Include="Scrutor" Version="5.1.0" />
+    <PackageVersion Include="Scrutor" Version="6.0.1" />
     <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
     <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
     <PackageVersion Include="Serilog.Sinks.Console" Version="6.0.0" />
@@ -55,7 +55,7 @@
     <PackageVersion Include="System.Reactive" Version="6.0.1" />
     <PackageVersion Include="System.Runtime.Loader" Version="4.3.0" />
     <PackageVersion Include="System.Text.Json" Version="9.0.0" />
-    <PackageVersion Include="System.Threading.Channels" Version="9.0.0" />
+    <PackageVersion Include="System.Threading.Channels" Version="9.0.1" />
     <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="8.0.1" />
     <PackageVersion Include="System.Threading.Tasks.Extensions" Version="4.6.0" />
   </ItemGroup>

test/Directory.Packages.props

@@ -12,7 +12,7 @@
   <ItemGroup>
     <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="17.13.1" />
     <PackageVersion Include="FluentAssertions" Version="7.0.0" />
-    <PackageVersion Include="MSTest" Version="3.7.1" />
+    <PackageVersion Include="MSTest" Version="3.7.2" />
     <PackageVersion Include="Moq" Version="4.20.72" />
   </ItemGroup>
 </Project>